user981178's questions

When configuring a mail server, should it be setup to receive mail at the hostname or just the domain?

For example, if the hostname of the mail server is sub.domain.tld, should mail from anywhere be able to be sent to [email protected] or just to [email protected], with addresses @sub.domain.tld only available for local processes?

Is there an official way it should be configured or is it up to the administrator?

What is the best or proper way to specify two http hosts with the same document root on Lighttpd? For example, to serve a domain at example.org and www.example.org.

Given the following in the lighttpd.conf for one host:

$HTTP["host"] == "www.example.org" {
  server.document-root = "/path/to/root/example" 
}

Is this a valid configuration for two hosts?

$HTTP["host"] == ( "example2.org", "www.example2.org" ) {
  server.document-root = "/path/to/root/example2" 
}

Or do you have have to duplicate/repeat the $HTTP["host"] field for each?

Is there a standard time duration before DNS caches are cleared, so that if a distracted operator or stuck key turns a TTL of 86400 into 864000000 you don't end up with an authoritative resource record or even entire DNS zone whose changes won't be recognized for 27.397 years?

And, if there is no protection against this sort of error, then what is the reasoning behind allowing TTL duration up to 68 years instead of a maximum value of perhaps one month?

I often see tutorials for setting up Postfix with the virtual mailbox delivery agent on Linux that instruct to create a new disabled-login user and group to own virtual mailboxes in /home/example_username. This, of course, makes sense and is a viable option.

In the virtual mailbox example in the Postfix documentation he uses the following settings, but does not discuss what, if any, user(s) have been created:

http://www.postfix.org/VIRTUAL_README.html#virtual_mailbox

/etc/postfix/main.cf

virtual_mailbox_base = /var/mail/vhosts
virtual_minimum_uid = 100
virtual_uid_maps = static:5000
virtual_gid_maps = static:5000

Debian, by default, includes a mail user and group, uid 8 and gid 8, with home directory /var/mail. Is there any reason not to use this user and group to own the virtual mailboxes? Perhaps adjusting the above example as follows. I know the point of the virtual_minimum_uid is to be a safety mechanism to prevent mail being written to sensitive files, but if the uid and gid are defined as static entries, is there any danger in using this setup?

/etc/postfix/main.cf

virtual_mailbox_base = /var/mail/vhosts
virtual_minimum_uid = 8
virtual_uid_maps = static:8
virtual_gid_maps = static:8

I am setting up a Postfix SMTP server (pre v2.10) and was thinking to put the smtpd_recipient_restrictions as follows.

smtpd_recipient_restrictions=
    permit_mynetworks,
    reject_non_fqdn_recipient,
    reject_unknown_recipient_domain,
    reject_unauth_destination,
    reject_rbl_client sub.domain.tld,
    reject_rhsbl_reverse_client sub.domain.tld,
    reject_rhsbl_helo sub.domain.tld,
    reject_rhsbl_sender sub.domain.tld,
    check_policy_service unix:private/policyd-spf

Would it work, and might it be an even better idea, to put the SPF checks before the RBL and RHSBL checks, so as to limit (if the SPF check might block something before reaching the RBL and RHSBL checks) the number of queries to the RBL and RHSBL lists/services?

Thank you.

I want to setup Postfix and Dovecot with Postfix as the SMTP MTA (mail transfer agent) and the MDA (mail delivery agent) and Dovecot just as the IMAP server, but I want to make sure that they each understand the mailbox location, and I am not totally clear on this from the documentation.

If I use the following settings in the Postfix main.cf (username represents a system user that is setup to handle all virtual users):

virtual_mailbox_base=/home/username
virtual_mailbox_maps=hash:/etc/postfix/vmailbox

And in /etc/postfix/vmailbox (the / at the end of the mailbox path indicates a maildir mailbox):

[email protected] example.com/info/
[email protected] example.com/sales/

So that the mailboxes would look like /home/username/example.com/info/ and so forth, as described in the documentation (http://www.postfix.org/VIRTUAL_README.html#virtual_mailbox).

And then use the following settings in the Dovecot dovecot.conf:

mail_home=/home/username/%d/%n
mail_location=maildir:~/Maildir

So that Dovecot has separate "home" and mailbox directories for the virtual users, as recommended in the documentation (http://wiki2.dovecot.org/VirtualUsers/Home), will this be a compatible setup?

Or, will Postfix be delivering mail to /home/username/example.com/info in cur, new, and tmp folders while Dovecot is looking for mail in /home/username/example.com/info/Maildir in cur, new, and tmp folders? Does the / to activate a maildir mailbox in the Postfix virtual_mailbox_maps indicate and automatically create a Maildir folder after example.com/info/ or will it create the difficulty I describe above?

Thank you.

I have noticed that a number of different web and mail server software allow or require you to provide the TLS certificate (including server certificate, CA intermediate certificate, and CA root certificate) and private key in a single .pem file.

So, the server sends the certificate(s) to every client attempting to connect, but, of course, you want to keep your private key secure and secret. So, how does this work when they are all in the same file? Does the software know to only send the certificate parts and never send the private key, even though they are in the same file?

Thank you.

I used to operate a website with an SSL certificate, but have stopped using the SSL certificate. The problem is that most of the external links to the website use the https:// prefix.

I have tried the https:// to http:// redirect in the .htaccess file:

RewriteEngine On

RewriteCond %{HTTPS} on
RewriteRule ^(.*)$ http://%{HTTP_HOST}%{REQUEST_URI}

But it seems, as has been pointed out elsewhere, that the server is trying to retrieve the certificate before activating the redirect. Hence, an error is shown before the redirect is ever accomplished. The error is either a warning that the certificate is expired, or if I delete the certificate signing request, then an error that SSL received a record that exceeded the maximum permissible length.

Is there any way to allow the incoming links to be redirected properly?